Messages in this thread Patch in this message | | | From | Marcel Ziswiler <> | Subject | Re: [PATCH v1 1/2] Bluetooth: btnxpuart: Fix btnxpuart_close | Date | Wed, 18 Oct 2023 16:23:44 +0000 |
| |
Hi Neeraj
On Wed, 2023-10-18 at 15:36 +0000, Neeraj sanjay kale wrote: > Hi Marcel, > > Thank you for your patch. > > > From: Marcel Ziswiler <marcel@ziswiler.com> > > Sent: Wednesday, October 18, 2023 8:26 PM > > To: linux-bluetooth@vger.kernel.org > > Cc: Sherry Sun <sherry.sun@nxp.com>; Johan Hedberg > > <johan.hedberg@gmail.com>; Luiz Augusto von Dentz > > <luiz.dentz@gmail.com>; Neeraj sanjay kale <neeraj.sanjaykale@nxp.com>; > > linux-kernel@vger.kernel.org; Marcel Holtmann <marcel@holtmann.org>; > > Marcel Ziswiler <marcel.ziswiler@toradex.com>; Amitkumar Karwar > > <amitkumar.karwar@nxp.com>; Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> > > Subject: [PATCH v1 1/2] Bluetooth: btnxpuart: Fix btnxpuart_close > > > > From: Marcel Ziswiler <marcel.ziswiler@toradex.com> > > > > Unfortunately, btnxpuart_close() may trigger a BUG: scheduling while atomic. > > Fix this by properly purging the transmit queue and freeing the receive skb. > > > > Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP > > Bluetooth chipsets") > > > > Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> > > --- > > > > drivers/bluetooth/btnxpuart.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c > > index b7e66b7ac570..9cb7529eef09 100644 > > --- a/drivers/bluetooth/btnxpuart.c > > +++ b/drivers/bluetooth/btnxpuart.c > > @@ -1234,6 +1234,9 @@ static int btnxpuart_close(struct hci_dev *hdev) > > > > ps_wakeup(nxpdev); > > serdev_device_close(nxpdev->serdev); > > + skb_queue_purge(&nxpdev->txq); > > + kfree_skb(nxpdev->rx_skb); > > + nxpdev->rx_skb = NULL; > > clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state); > > return 0; > > } > This is already done in btnxpuart_flush(), which is called by hci_dev_close_sync(), before it calls > btnxpuart_close().
Yes, I was also wondering about that.
> Is btnxpuart_flush() not called during your testing?
Yes, I even added some more tracing to confirm this. However, without my fix (which BTW was inspired by looking at the former hci_mrvl.c driver) this bug is really occuring. Just keep loading/un-loading the kernel module a few times any you may hit it.
> Thanks, > Neeraj
Cheers
Marcel
| |